CVE-2026-90708 - Yot CMS Cookie global.php login sql injection

Back Back to CVE browser

MEDIUM

Yot CMS Cookie global.php login sql injection

Published Sep 14, 2026

6.9

MEDIUM

CVSS 4.0

EPSS 0.41%

Description

A weakness has been identified in Yot CMS up to 3.3.1. Affected by this vulnerability is the function Login of the file global.php of the component Cookie Handler. This manipulation of the argument yot3_user/yot3_pass causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.

Affected products

Vendor Yot Product CMS Default
n/a
- Version
  3.3.0
  Status
  affected
  Constraints
  -
- Version
  3.3.1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Yot

CMS

n/a

Version	Status	Constraints
3.3.0	affected	-
3.3.1	affected	-

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-74

CWE-89

SQL Injection

References (5)

https://github.com/dddwmr/CVE/blob/main/YOT%20III%20cookie%20auto-login%20SQL%20injection%20enables%20forged%20administrator%20sessions%20.md
exploit
https://vuldb.com/cve/CVE-2026-90708
third-party-advisory
https://vuldb.com/submit/918272
third-party-advisory
https://vuldb.com/vuln/403250
vdb-entrytechnical-description
https://vuldb.com/vuln/403250/cti
signaturepermissions-required

Link	Providers	Tags
https://github.com/dddwmr/CVE/blob/main/YOT%20III%20cookie%20auto-login%20SQL%20injection%20enables%20forged%20administrator%20sessions%20.md		exploit
https://vuldb.com/cve/CVE-2026-90708		third-party-advisory
https://vuldb.com/submit/918272		third-party-advisory
https://vuldb.com/vuln/403250		vdb-entrytechnical-description
https://vuldb.com/vuln/403250/cti		signaturepermissions-required